American woman at the center of a $5 million cryptocurrency theft: new details from the on-chain investigation
On-chain analyst ZachXBT has revealed the involvement of U.S. citizen Tiffany Milanovich in a large-scale cryptocurrency theft scheme totaling at least $5 million. The case involves a series of attacks built on fake calls from purported crypto service support teams.
According to my analysis of the investigation materials, Milanovich served as a "call operator": she called victims, posing as a tech support employee, and convinced them to hand over control of their funds. Notably, after successfully draining accounts, she recorded videos mocking the victims—a detail that underscores the cynical nature of this criminal group.
Attack Scheme
Milanovich operated as part of an organized group, impersonating the real support services of hardware wallets and centralized exchanges. The infrastructure for phishing sites was provided by two other participants known by the pseudonyms "bled" and "harm."
One of the largest attacks was recorded in June 2026, when a victim lost $1.2 million in Bitcoin and Ethereum. The funds were withdrawn from a Trezor hardware wallet. The attack began with a fake email from BitcoinIRA, signed by a certain Patricia Massi. Notably, a significant portion of the stolen assets has not yet been moved and remains in on-chain wallets.
Another incident occurred in October 2025: a victim lost $500,000 in Bitcoin after withdrawing funds from a Coinbase account. According to the investigation, Milanovich complained about a "small share" at the time and even posted transaction screenshots on social media.
Spending and Connections
Milanovich did not hide her expenses: she openly showcased luxury purchases and casino bets made with victims' money on social media. Some of the "boastful" videos were edited to make the theft amounts appear even more impressive than they actually were.
A connection was also established between Milanovich and John "Lick" Dagita, who was previously accused of stealing cryptocurrency seized by U.S. authorities. In March, Dagita was detained in Saint Martin.
These schemes are just part of a troubling trend of rising impersonation fraud. The FBI recorded more than 80,000 complaints about fake tech support and government officials in 2025 alone, with losses exceeding $2.9 billion. According to Chainalysis, the number of such attacks in the crypto sector grew by nearly 1400% last year.
My comment: This case is a stark reminder that even hardware wallets do not protect against social engineering. The industry needs to more actively implement multi-factor authentication and user education; otherwise, such schemes will continue to thrive despite all the efforts of analysts and law enforcement.